You open the acquisition report to find out what Tuesday's newsletter did. Organic Search: 1,240 sessions. Direct: 890. Email: twelve. Twelve. Your sending tool reports 240 clicks, GA4 shows twelve sessions. The other 228 are not lost, they are sitting in the Direct bucket.
This piece explains why GA4 files a session as (direct) / (none), breaks the bucket into the sources it really contains, shows two tests that tell you in ten minutes how much of it is real, and ends with the UTM rules against it.
What "(direct) / (none)" in GA4 actually means
At session start GA4 looks in two places for an origin: the campaign parameters in the URL (utm_source, utm_medium and relatives, plus gclid from Google Ads) and the referrer the browser sends in the HTTP header Referer.
If both are empty, GA4 sets the session source to (direct) and the medium to (none), and the default channel group files it under "Direct". Google's condition reads literally: source exactly matches "(direct)" and medium is one of "(not set)" or "(none)".
That gives away the most important property of this channel: Direct is a leftover category, not a description of behaviour. Google's own gloss, "users who arrive via a saved link or by typing your URL", covers a fraction of what ends up there. (not set) and "Unassigned" are different animals: the first means a dimension has no value, the second that a source arrived and matched no channel rule. Direct means nothing arrived.
Where your direct traffic actually comes from
The umbrella term for the larger part of this bucket is dark traffic, or dark social: real recommendations arriving without a trace.
Links inside documents. A heating installer in Manchester sends its price list as a PDF with a link to the grants page. Click that in Acrobat and you arrive with no referrer: the document has no web address to come from. Same for Word files and slides. In B2B, quotes and price lists are often the biggest direct source.
Desktop mail clients. Click a link in Gmail in the browser and a referrer from a Google domain comes along. In Outlook, Apple Mail or Thunderbird the program hands the URL to the browser, which has no previous page. Those twelve sessions above came from webmail.
Messengers. Someone drops your page into a WhatsApp group or sends it over Signal: the most valuable recommendation there is, and indistinguishable from a random visit.
Apps with a built-in browser. LinkedIn and Instagram open links in their own window inside the app, and whether a referrer survives depends on the app, its version and the operating system. That is why social traffic can look far smaller in GA4 than in the platform's own click counts.
QR codes. The camera app opens the URL directly, there is no previous page, so there can never be a referrer. A QR code on a van or a trade show flyer is guaranteed direct traffic without UTM parameters.
Bookmarks and genuinely typed addresses. The part the channel name describes, and it is real. One detail: type a company name into the address bar and most browsers run a Google search, so the visit arrives as Organic Search. Only a fully typed domain becomes direct, which is why typing lands on the homepage.
The jump from https to http. If an external https page links to an http address of yours, the browser throws the referrer away. That is the default policy strict-origin-when-cross-origin: on a downgrade to the insecure protocol the Referer header is not sent. One stale http URL is enough.
A referrer policy set to no-referrer. Some sites never send an origin at all, and if one of those links to you, you see nothing. Do not set that value on your own site either, or you destroy the reports of everyone you link to.
Redirect chains. The more stops between click and destination (link shorteners, click trackers, a meta refresh, a redirect in JavaScript), the better the chance the referrer or the query parameters get dropped. The second is the bitter one: you tagged the link and the redirect cut your utm_source off.
Answers from AI assistants. Copy a link out of a ChatGPT answer and open it later, or arrive from an AI app on a phone, and you land in direct too. How to see the part that does send an origin is covered in measuring AI traffic in GA4.
Two neighbours here are not dark traffic: part of your direct sessions is not human but automated traffic, and a cookie banner collecting refusals shifts the proportions between all channels, see consent mode and GA4 data.
The test that exposes dark traffic: landing pages
Open Reports → Acquisition → Traffic acquisition and add a filter: dimension "Session default channel group", match type "exactly matches", value Direct. Then set the primary dimension to "Landing page" and sort by sessions descending.
The rule to read it by: nobody types /services/heat-pump-grants by hand.
The installer from the example has 890 direct sessions, 610 of them on that one subpage and 90 on the homepage. That is not brand growth, that is referrer loss. The link exists somewhere: in a PDF, a forum post, a trade association mailing. The question is no longer "why is direct so high" but "where is that link", and that one has an answer.
The counter-check: if 70 to 80 percent of direct sessions sit on the homepage, the bucket is plausibly real. Bookmarks, business cards, brand recall.
The second test takes two minutes: lay the trend against your own calendar. Set the range to 30 days and look at the daily curve. A law firm in Portland that sends its newsletter Tuesday at ten and sees three times as much direct traffic on Tuesdays as on Thursdays has not found a brand phenomenon, it has an untagged newsletter. Every spike landing on something you did is a source you can tag.
Using UTM parameters properly so nothing lands in the bucket
UTM parameters are the only way to pass an origin where no referrer exists.
| Parameter | What it answers | Example value |
|---|---|---|
utm_source | Who sent the visitor | newsletter, linkedin, van |
utm_medium | What kind of channel (drives the grouping) | email, social, offline |
utm_campaign | Which activity was this | 2026-08-heat-pumps |
utm_content | Which placement or variant | text-link-top, header-image |
utm_medium matters most, because GA4 hangs the channel grouping on it. Only utm_medium=email puts a newsletter in the "Email" channel; write NL and it matches no rule, so the session becomes "Unassigned", no better than direct.
Newsletter
https://example-law.com/guides/estate-tax?utm_source=newsletter&utm_medium=email&utm_campaign=2026-08-estate-tax&utm_content=text-link-top
LinkedIn post
https://example-law.com/case-study-probate?utm_source=linkedin&utm_medium=social&utm_campaign=case-study-probate
QR code on the company van
https://example-heating.com/heat-pumps?utm_source=van&utm_medium=offline&utm_campaign=qr-van-2026
Link in an email signature
https://example-heating.com/grants?utm_source=signature&utm_medium=email&utm_campaign=team-signature
Point QR codes at a short address that 301s to the tagged URL, because a dense pattern scans badly off a moving van.
Then the naming convention most people skip. GA4 stores values exactly as you wrote them, so Newsletter, newsletter and NL are three rows in your report. Four rules are enough: lower case, no spaces, hyphens as separators, date first on campaigns. Keep the used values in one table, or within a year you will have six spellings for one channel.
The trap: UTM parameters on internal links
This is the most common self-inflicted wound, and the usual explanation for it is wrong.
The mistake: someone wants to know how often the homepage banner gets clicked and builds ?utm_source=homepage&utm_medium=banner into the internal link. But UTM parameters describe where someone came from before they entered your domain. Not what they do afterwards.
The claim you will hear is that the click tears the session apart and starts a new one, so you see twice as many sessions. That was Universal Analytics. In GA4 a session starts on first activity and after 30 minutes of inactivity; a campaign change mid-visit does not end it.
The damage is real anyway, just different. First, your internal labels show up as source and campaign where they do not belong: a row reading "homepage / banner" that brought in zero visitors, because the visitor was already there. Second, conversion credit moves around: GA4 spreads credit for a key event across the touchpoints it knows, and the internal touchpoint competes with the channel that actually delivered the person. The enquiry search earned lands on the banner. Third, /pricing and /pricing?utm_source=homepage are two addresses with identical content to a search engine.
The symptoms: a source you recognise as an internal element, landing pages in that channel nothing external links to, and conversion numbers that stop matching the enquiries arriving.
So the rule is absolute: UTM parameters only on links from outside your domain. Internal clicks get measured as events, not campaigns, see setting up conversion tracking.
What you can do technically about referrer loss
Https everywhere. Every http URL of yours out in the world or in an old PDF loses its referrer on click, and Strict-Transport-Security tells the browser not to try http again.
Keep redirects short: one hop, one 301, done. Then check that the parameters survive:
curl -sI "https://example.com/offer?utm_source=newsletter&utm_medium=email" \
| grep -i "^location"
If the location header shows the target without ?utm_source=..., you found it: that redirect throws your campaign data away, and every tagged link through it arrives as direct.
Leave the referrer policy on the browser default:
Referrer-Policy: strict-origin-when-cross-origin
External sites then learn which domain the visitor came from, but not which page. no-referrer sounds more privacy-friendly, costs your partners their data and gains you nothing.
And tag links by hand wherever no referrer can exist: newsletters, signatures, PDFs, quotes, slides, QR codes, printed URLs.
How much direct traffic is normal?
From experience, not from a study: on an ordinary business website direct usually sits between ten and twenty percent of sessions. A known brand with repeat customers runs higher, and that is fine. Forty percent at a company nobody searches by name is not a compliment, it is a measurement problem. Above half, check for bots and broken tracking first.
Just as important is when to stop. Direct never reaches zero, and much of it is unreachable in principle: the WhatsApp recommendation, a third party's PDF, a partner's flyer. Optimise that remainder away and you end up with campaign parameters in links nobody maintains.
You can tell when the work is done: you have tagged everything you send out yourself, and the remaining direct share no longer changes your decisions. The goal was never a prettier pie chart, it was the answer to whether the newsletter is worth writing. How to turn that into action is in reading GA4 reports and analyzing user behaviour.
Where to start
- Open Reports → Acquisition → Traffic acquisition, filter to
Direct, set the primary dimension to "Landing page", note the three most common entry pages. - If a deep subpage is among them, hunt the link: search the URL in Google, check the links report in Search Console, ask internally where that address got printed.
- In the daily curve of the last 30 days, mark every spike that falls on something you did. That is your tagging list.
- Tag the newsletter first, then the email signatures, then the QR codes, following the naming convention.
- Walk your internal links and strip out every UTM parameter you find.
Two weeks later, compare: what does "Email" have now, and what did direct have before?
Frequently asked questions
What does direct traffic mean in GA4?
Direct covers every session for which GA4 found no origin at session start: no referrer, no campaign parameters in the URL. Most of it is not people typing your address in, but visitors with a real recommendation whose origin got lost on the way.
What does "(direct) / (none)" mean?
That is the session source and medium GA4 assigns when no origin could be determined, and it produces the "Direct" row in the default channel group. Do not confuse it with (not set), where a dimension has no value, or "Unassigned", where a source arrived and matched no channel rule.
Why is my direct traffic so high?
Usually because your own channels are untagged: a newsletter without UTM parameters lands almost entirely in direct, because mail clients send no referrer, and QR codes and PDF links never do. The second cause is referrer loss in transit.
What is dark traffic?
Dark traffic, often dark social, is the part of direct traffic with a real recommendation behind it that arrives without a trace: links from WhatsApp and Signal, mail clients, PDFs, apps with a built-in browser. What you send out yourself can be tagged; the rest stays invisible.
How do I tag a newsletter correctly?
Add utm_source=newsletter, utm_medium=email and a dated utm_campaign such as 2026-08-estate-tax to every link. The decisive one is utm_medium=email, because only that files the session under "Email"; NL ends up in "Unassigned". Tell several links apart with utm_content.
Why do my social media visitors show up as direct?
Because apps open links in a built-in browser and do not always pass an origin along. The way out: when you post yourself, tag the link with utm_source=linkedin and utm_medium=social. What others share stays dark.
Can I attribute direct traffic after the fact?
Not the sessions themselves: what GA4 did not capture at session start cannot be reconstructed later, and there is no reprocessing or import. Conversions look better, because the attribution models largely skip a direct touchpoint and credit the key event to the last known channel before it.
How much direct traffic is normal?
On an ordinary business website the share tends to sit between ten and twenty percent. Known brands with loyal customers run higher, which is a good sign. Forty percent or more at a company hardly anyone searches by name is a measurement problem.
Why does a link lose its referrer?
Three reasons. First, the source has no web address, because the link sat in a PDF, a mail client or a QR code. Second, the browser withholds it on a click from https to http, the default strict-origin-when-cross-origin. Third, the linking site suppresses it with Referrer-Policy: no-referrer. Plus redirect chains that strip the query parameters.